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Detailed Action 

Claims 1-25 are pending in this application. This action is a response to the 
election filed on 12/17/04. Claims 11, 12, 21, 22, 25 are withdrawn from consideration. 

Election/Restrictions 
Restriction to one of the following inventions is required under 35 U.S.C. 121: 

I. Claims 1-9,10,13-20,23-24, drawn to the transfer of data packets from one 
location to another, classified in class 709, subclass 231 . 

II. Claimsl 1,12, drawn to a modifying information or program based on the 
data packets, classified in class 709, subclass 228. 

II. Claims 21 ,22,25, drawn to determining intruding data packets into the 

network, classified in class 709, subclass 250. 
The applicant has elected Group 1 without traverse for examination. 

Information Disclosure Statement 
The IDS filed on 6/14/01 and 1/18/05 has been considered. 

Provisional Double Patenting 

The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. See In re Goodman, 1 1 
F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 
USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 
1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970);and, In re Thorington, 
418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double 
patenting ground provided the conflicting application or patent is shown to be commonly 
owned with this application. See 37 CFR 1.130(b). 
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Effective January 1 , 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 
37 CFR 3.73(b). 

"A later patent claim is not patentably distinct from an earlier patent claim if the 
later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 
896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting 
because the claims at issue were obvious over claims in four prior art patents); In re 
Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of 
obviousness type double patenting where a patent application claim to a genus is 
anticipated by a patent claim to a species within that genus). " ELI LILLY AND 
COMPANY V BARR LABORATORIES, INC., United States Court of Appeals for the 
Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 
2001). 

Claims 1-34 of Application #09/881,074 contains every element of claims 1- 
9,10,13-20,23-24 of this instant application and as such anticipates claims 1-9,10,13- 
20,23-24 of the instant application. It is noted that claims of application 09/881 ,074 are 
allowable, the application has not been issued a patent number. 

Claims 1-47 of Application 10/251,403 contains every element of claims 1- 
9,10,13-20,23-24 of this instant application and as such anticipates claims 1-9,10,13- 
20,23-24 of the instant application. 

Claims 1-37 of Application 10/655,245 contains every element of claims 1- 
9,10,13-20,23-24 of this instant application and as such anticipates claims 1-9,10,13- 
20,23-24 of the instant application. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 
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Claims 23-24 are rejected under 35 U.S.C. 102(b) as being anticipated by US 
Patent 6,038,233 issued to Hamamoto et al.(Hamamoto). 

As per claim 23, Hamamoto teaches in a device operatively coupled to a 
network, a computer-readable data signal having a body portion for use in identifying an 
ingress location of a target packet in said network, said body portion comprising(Fig.1- 
13): a hash value identifying said target packet as detected by said device(Fig.7; col.5, 
lines 66-C0I.6, line 67), said hash value of said target packet having been computed by 
said device(Figs.1-4); and identification information about said device(Fig.1 1A,B). 

As per claim 24, the computer-readable data signal of claim 23 further 
comprising a header portion, said header portion comprising: a network 
address(Fig.11A,B). 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1-5,7,10,13,14,17.19, 23-24 are rejected under 35 U.S.C. 102(e) as being 
anticipated by US Patent 6,389,419 issued to Wong et al.(Wong) 

As per claim 1,10, Wong teaches a network carrying a plurality of packets over at 
least one network link, said network including a computer, a first network component 
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having memory and a processor and configured to store information in said memory 
about at least one of said plurality of packets, and a second network component, a 
method for detecting a target packet(Figs,1-8) comprising: 

receiving said at least one of said plurality of packets over said link to obtain a received 
packet(col.3, lines 55-63); 

determining a hash value of at least a portion of said packet(col.3, line 60-col.4, line 9); 
using said hash value to identify a location in said memory(col.3, line 60-col.4,line 9); 
setting a flag in said memory, said flag associated with said location(col.6, lines 9-15); 
receiving a query message identifying a target packet at said first network 
component(Fig.1A, col. 4, line 17-28, col. 5, lines 59-col.6, line 4); 
said first network component using said flag in processing said query message to 
determine if said target packet has been encountered(col.6, lines 4-46); 
creating a reply if said target packet has been encountered(col.6, lines 9-12); and 
said first network component making said reply available to said network if said target 
packet has been encountered(col.6, lines 26-37); 

As per claim 2, the method of claim 1 and wherein making said reply available to 
said network includes forwarding said reply to said second network component(col.1 , 
line 64-67). 

As per claim 3, the method of claim 2 and wherein said second network 
component is a computer(Fig.lA). 

As per claim 4, the method of claim 1 and wherein said reply contains a network 
address for said first network component(Fig.1 A). 
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As per claim 5, the method of claim 1 and wherein said hash value is determined 
over the entire packet(col.5, lines 65-col.6, line 3), 

As per claim 7,17 wherein said network is an Internet Protocol (IP) 
network(col.7,lines 55-56). 

As per claim 13, Wong teaches an a network carrying a plurality of packets over 
at least one link, said network including a plurality of devices and a system operatively 
coupled to said link, said system for assisting with the location of an intrusion point of a 
target packet in said network(Figs.1-8), said system comprising: 
a first interface for receiving at least one of said plurality of packets to obtain at 
least one received packet(col.3, lines 55-col.4, line 8); 

a second interface for placing a subset of said at least one received packet onto 
said link(col.5, lines 43-67); 

a bus communicatively coupled to said first interface and said second interface(Fig.1 A); 
a memory communicatively coupled to said bus, said memory storing information 
about said at least one received packet in a machine-readable form(Fig.1 B); 
a processor communicatively coupled to said bus and said memory, said processor 
executing machine-readable instructions for processing said at least one received 
packet{col.3, lines 55-col.4, Iine7); 

a plurality of first hash values, each one of said plurality of first hash values 
determined from said at least one received packet respectively(col.4, lines 17-28); 
a second hash value determined from at least a portion of said target packet(col.6, lines 
5-25); 



Application/Control Number: 09/881 ,145 Page 7 

Art Unit: 2151 

and a reply made available to certain of said devices in said network using said second 
interface, said reply made in response to comparing said second hash value to each 
one of said plurality of first hash values(col.6, lines 4-46). 

As per claim 14, the system of claim 13 and wherein said first interface and said 
second interface are combined into a single bi-directional interface(col.4, lines 17-28). 

As per claim 19, the system of claim 13 and wherein said reply is a positive reply 
if said second hash value matches at least one of said plurality of first hash 
values(col.6, lines 4-67). 

As per claim 23, Wong teaches in a device operatively coupled to a network, a 
computer-readable data signal having a body portion for use in identifying an ingress 
location of a target packet in said network, said body portion comprising(Fig.1-8): a 
hash value identifying said target packet as detected by said device(col.3, lines 55-67), 
said hash value of said target packet having been computed by said device(Figs.1-8, 
col.3, lines 55-col.4, line 10); and identification information about said device(col.1, lines 
30-45). 

As per claim 24, the computer-readable data signal of claim 23 further 
comprising a header portion, said header portion comprising: a network address(col.1, 
lines 58-67). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 



Application/Control Number: 09/881 , 1 45 Page 8 

Art Unit: 2151 

(a) A patent may not be obtained though the invention is not identicalty disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claim 6,8,16 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 

Patent 6,389,419 issued to Wong et aL(Wong) in view of US 6,842,861 issued to Cox et 

al.(Cox). 

Wong teaches all the limitations of claims 1, 10,13, however does not teach as 
per claim 6, the method of claim 1 , further comprising: determining if said received 
packet has undergone a transformation, such transformation having occurred if a first 
hash value of at least a portion of said packet computed at a first time is not equal to a 
second hash value of at least a portion of said packet computed at a second time, said 
second time occurring after said first time. 

Cox teaches determining if said received packet has undergone a transformation, 
such transformation having occurred if a first hash value of at least a portion of said 
packet computed at a first time is not equal to a second hash value of at least a portion 
of said packet computed at a second time, said second time occurring after said first 
time(col.2, lines 34-41). 

Therefore it would have been obvious to one ordinary skilled in the art at the time 
of the invention to modify the teaching of Wong to add determining if said received 
packet has undergone a transformation, such transformation having occurred if a first 
hash value of at least a portion of said packet computed at a first time is not equal to a 
second hash value of at least a portion of said packet computed at a second time, said 
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second time occurring after said first time as taught by Cox in order to determine 
infected files(Cox, col. 2, lines 34). 

One ordinary skilled in the art at the time of the invention would have been 
motivated to combine Cox and Wong in order to provide a system to detect a file with a 
virus(Cox. Col.1, lines 5-67). 

As per claim 8,16 wherein said link is a wireless link and network is a wireless 
network(Cox,Fig.1). 

Therefore it would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teaching of Wong to add wherein said link is a wireless link and 
network is a wireless network as taught by Cox in order to send data from wireless 
devices. 

One ordinary skilled in the art at the time of the invention would have been 
motivated to combine Cox and Wong in order to provide a system to use wireless 
devices to send data. 

Claims 9,15,18,20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over US Patent 6,389,419 issued to Wong et al.(Wong) in view of Office Notice. 

Wong teaches all the limitation of claims 1,13, however does not explicitly teach 
as per claim 9. the method of claim 1 and wherein said first network component is a 
router, 15, the system of claim 13 and wherein said reply is made available to another 
network, 18, the system of claim 13 and wherein said processor is an ASIC, 20, the 
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system of claim 13 and wherein said reply is forwarded to those of said devices one hop 
away. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the time of 
the invention to use routers as a network component in order expedite message 
delivery and to transmit messages and fonA^ard them to their correct destinations over 
the most efficient available route. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong and use routers in order to provide a system 
to correctly transmit messages from one location to another. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the time of 
the invention to send replies to another network in order for other computers on a 
different network to receive information about the current network. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong and send data to other networks in order to 
provide a system to ensure other networks would know the current status of certain 
network components on the system of the user. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the time of 
the invention to use ASIC as the processor in order to connect gates on the chips for a 
specific function. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong and use ASIC as the processor in order to 
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provide a system to change the pattern of connections on the chip which can make the 
chip suitable for many needs. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the 
time of the invention to reply is forwarded to those of said devices one hop away in 
order to inform the devices closest to the sending device about information on the 
network. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong and the reply is fonA/arded to those of said 
devices one hop away in order to provide a system to inform devices of information 

Claims 1-5,7,9,10,13-15,17,19, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over US Patent 6,389,419 issued to Wong et al.(Wong) in view of US 
5,959,976 issued to Kuo. 

As per claim 1,10,13 Wong teaches a network carrying a plurality of packets over 
at least one network link, said network including a computer, a first network component 
having memory and a processor and configured to store information in said memory 
about at least one of said plurality of packets, and a second network component, a 
method for detecting a target packet(Figs,1-8) comprising: 

receiving said at least one of said plurality of packets over said link to obtain a received 
packet(col.3, lines 55-63); 
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determining a hash value of at least a portion of said packet(col.3, line 60-col.4, line 9); 

using said hash value to identify a location in said memory(col.3, line 60-col.4,line 9); 

receiving a query message identifying a target packet at said first network 

component(Fig.1A, col. 4, line 17-28, col, 5, lines 59-col.6, line 4); 

said first network component using said flag in processing said query message to 

determine if said target packet has been encountered(col.6, lines 4-46); 

creating a reply if said target packet has been encountered(col.6, lines 9-12); and 

said first network component making said reply available to said network if said target 

packet has been encountered(col.6, lines 26-37); a first interface for receiving at least 

one of said plurality of packets to obtain at 

least one received packet(col.3, lines 55-col.4, line 8); 

a second interface for placing a subset of said at least one received packet onto 
said link(col.5, lines 43-67); 

a bus communicatively coupled to said first interface and said second interface(Fig.1 A); 
a memory communicatively coupled to said bus, said memory storing information 
about said at least one received packet in a machine-readable form(Fig.1 B); 
a processor communicatively coupled to said bus and said memory, said processor 
executing machine-readable instructions for processing said at least one received 
packet(col.3, lines 55-col.4, Iine7); 

a plurality of first hash values, each one of said plurality of first hash values 
determined from said at least one received packet respectively(coL4, lines 17-28); 
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a second hash value determined from at least a portion of said target packet(col.6, lines 
5-25); 

and a reply made available to certain of said devices in said network using said second 
interface, said reply made in response to comparing said second hash value to each 
one of said plurality of first hash values(col.6, lines 4-46). 

However, Wong does not explicitly teach setting a flag in said memory, said flag 
associated with said location. 

Kuo teaches setting a flag in said memory, said flag associated with said 
location(Abstract). 

Therefore it would have been obvious to one ordinary skilled in the art at the time 
of the invention to modify the teachings of Wong to add setting a flag in said memory, 
said flag associated with said location as taught by Kuo in order to determine whether a 
data packet is allowed to pass or block(Kuo, col. 6, lines 43-45). 

One ordinary skilled in the art at the time of the invention would have been 
motivated to combine Wong and Kuo in order to provide a system to determine which 
data packets will be blocked or passed to another device(Kuo, coL6, lines 43-45). 

As per claim 2, the method of claim 1 and wherein making said reply available to 
said network includes forwarding said reply to said second network component(Wong, 
col.1, line 64-67). 

As per claim 3, the method of claim 2 and wherein said second network 
component is a computer(Wong, Fig.lA). 
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As per claim 4, the method of claim 1 and wherein said reply contains a network 
address for said first network component(Wong, Fig.1 A). 

As per claim 5, the method of claim 1 and wherein said hash value is determined 
over the entire packet(Wong, col. 5, lines 65-col.6, line 3). 

As per claim 7,17 wherein said network is an Internet Protocol (IP) 
network(Wong, col. 7, lines 55-56). 

As per claim 9, the method of claim 1 and wherein said first network component 
is a router(Kuo, Fig.1). Motivation to combine set forth in claim 1. 

As per claim 14, the system of claim 13 and wherein said first interface and said 
second interface are combined into a single bi-directional interface(Wong, col. 4, lines 
17-28). 

As per claim 15, the system of claim 13 and wherein said reply is made available 
to another network(Kuo, Fig1). Motivation to combine set forth in claim 13. 

As per claim 19, the system of claim 13 and wherein said reply is a positive reply 
if said second hash value matches at least one of said plurality of first hash 
values(Wong, col. 6, lines 4-67); 

Claim 6,8,16 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 
Patent 6,389,419 issued to Wong et al.(Wong) in view of US 5,959,976 issued to Kuo in 
further view of US 6,842,861 issued to Cox et al.(Cox). 

Wong in view of Kuo teaches all the limitations of claims 1, 10,13, however does 
not teach as per claim 6, the method of claim 1 , further comprising: determining if said 
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received packet has undergone a transformation, such transformation having occurred if 
a first hash value of at least a portion of said packet computed at a first time is not equal 
to a second hash value of at least a portion of said packet computed at a second time, 
said second time occurring after said first time. 

Cox teaches determining if said received packet has undergone a transformation, 
such transformation having occurred if a first hash value of at least a portion of said 
packet computed at a first time is not equal to a second hash value of at least a portion 
of said packet computed at a second time, said second time occurring after said first 
time(col.2, lines 34-41). 

Therefore it would have been obvious to one ordinary skilled in the art at the time 
of the invention to modify the teaching of Wong in view of Kuo to add determining if said 
received packet has undergone a transformation, such transformation having occurred if 
a first hash value of at least a portion of said packet computed at a first time is not equal 
to a second hash value of at least a portion of said packet computed at a second time, 
said second time occurring after said first time as taught by Cox in order to determine 
infected files(Cox, col.2, lines 34). 

One ordinary skilled in the art at the time of the invention would have been 
motivated to combine Cox, Kuo, and Wong in order to provide a system to detect a file 
with a virus(Cox. Col.1, lines 5-67). 

As per claim 8,16 wherein said link is a wireless link and network is a wireless 
network(Cox,Fig.1). 
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Therefore it would have been obvious to one ordinary skilled in the art at the time 
of the invention to modify the teaching of Wong in view of Kuo to add wherein said link 
is a wireless link and network is a wireless network as taught by Cox in order to send 
data from wireless devices. 

One ordinary skilled in the art at the time of the invention would have been 
motivated to combine Cox, Kuo, and Wong in order to provide a system to use wireless 
devices to send data. 

Claims18,20 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 
Patent 6,389,419 issued to Wong et al.(Wong) in view of US 5,959,976 issued to Kuo in 
further view of Office Notice. 

Wong in view of Kuo teaches all the limitation of claims 1,13, however does not 
explicitly teach, 18, the system of claim 13 and wherein said processor is an ASIC, 20, 
the system of claim 13 and wherein said reply is fonA^arded to those of said devices one 
hop away. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the time of 
the invention to use ASIC as the processor in order to connect gates on the chips for a 
specific function. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong in view of Kuo and use ASIC as the 
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processor in order to provide a system to change the pattern of connections on the chip 
which can make the chip suitable for many needs. 

Office Notice is taken; it is obvious to one ordinary skilled in the art at the time of 
the invention to reply is forwarded to those of said devices one hop away in order to 
inform the devices closest to the sending device about information on the network. 

It would have been obvious to one ordinary skilled in the art at the time of the 
invention to modify the teachings of Wong in view of Kuo and the reply is forwarded to 
those of said devices one hop away in order to provide a system to inform devices of 
information 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. See PTO-892. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Backhean Tiv whose telephone number is (571)272- 
3941. The examiner can normally be reached on 9 A.M. -12 P.M. and 1 -6 P.M. 
Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung can be reached on (571) 272-3939. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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